Re: [Tcpcrypt] Initial questions

[Joe Touch <[e-mail]>]

On 6/18/2014 2:15 PM, Sandy Harris wrote:
> This is basically a fine idea & I'm glad to see people working on it.
>
> Some comments in the archive had me somewhat worried, and the current
> draft charter has the following:
>
> - When encryption is enabled, it must at least provide protection against
>    passive eavesdropping by default,
> ...
> When encryption is enabled, then the protocol:
> - must always provide forward secrecy.
> - must always provide integrity protection of the payload data ...
> - must always provide payload encryption.
>
> Why on Earth do these have "When encryption is enabled"? As others
> have said quite eloquently in various posts, there is no reason at all
> to even consider a null encryption mode; anyone who needs that can
> just fall back to TCP.

That's what "when encryption is enabled" means - i.e., there are (at 
least) two valid modes:

	use TCPCRYPT

	do not use TCPCRYPT

Regardless of what this WG develops, the latter will always need to be 
an alternative. The charter is perhaps being overly pedantic in noting 
that the gains claimed occur only when the methods indicated are in use.

Joe